A time series is a series of data points indexed in time order. A wide variety of data can be represented as a time series, such as daily temperatures, closing values of financial markets, as well as data relating to network performance such as latency, packet loss or network outages. Time series data can include one or more data points that may be anomalous or otherwise outside the normally expected range of values that is commonly associated with the specific variable being represented in the time series. To better understand the nature of the anomalous time series data points, it is advantageous to detect and accurately classify the anomalous data from the expected, non-anomalous data present in the time series.
Network data can often be represented as a time series. For example, many network performance characteristics can be measured as a function of time such as packet or link latency or the amount of up-time or down-time exhibited by a particular network entity, such as a switch, or by a collection of network entities. Evaluating network time series data for anomaly detection and correlation can rapidly become a complex problem as the overall network size and the dynamic interconnectedness of participating network entities constantly changes. For example, as physical networks become larger with a greater number of interconnections, the likelihood of network outages or failure events may also rise. In many cases, the network failures may be correlated, for example certain sets of links may tend to fail simultaneously due to single points of failures within the network. Similarly, latencies between large groups of endpoints pairs could increase simultaneously due to the degradation of shared portions of their path(s). Evaluating streams of network data in real-time to identify network failure events would greatly benefit network efficiency and operation, however doing so can be difficult because the network data often includes noise, missing values, and/or inconsistent time granularity. In addition, real-time monitoring and evaluation involves processing extremely large amounts of network data, which can be difficult to scale as the size and complexity of modern network infrastructures grow.